Vulnerability Disclosure Policy

1. In scope

• This marketing site and its access-request endpoint.
• The hosted Eresus Workbench and its public API, when tested from your own account and workspace.
• Authentication, authorization, and tenant-isolation weaknesses that would let one tenant reach another tenant’s data.
• Injection, deserialization, SSRF, access-control, and secret-exposure issues in our own service.

2. Out of scope

• Social engineering, phishing, or physical intrusion against staff or facilities.
• Denial-of-service, volumetric, or load testing against endpoints without a prior written agreement.
• Automated scanning of our production endpoints at volume, or scanning that degrades service for others.
• Third-party services we rely on, and any target you do not own or are not authorized to test. Report those to the vendor concerned.
• Findings that depend on a compromised device, a malicious browser extension, or an out-of-date unsupported browser.
• Missing hardening headers, cookie flags, or best-practice items with no demonstrated security impact.
• Reports generated solely by an automated scanner with no validated impact.

3. What to include

• The affected surface, route, or component, and the version or hosted URL you tested.
• Minimal reproduction steps and the realistic security impact.
• Sanitized request, response, log, or screenshot evidence that proves the issue.
• Whether the issue is already public, and any deadline you are working to.

4. Research boundaries

• Test only accounts, workspaces, and targets you are authorized to use. Never access another customer’s tenant, workspace, findings, or evidence.
• Do not run automated scanners or load tests against our endpoints without prior written agreement.
• Do not use social engineering, phishing, or physical intrusion against personnel or facilities.
• Keep the report private until we agree on a disclosure date, and sanitize any customer data before sending evidence.
• Stop testing and contact us immediately if you encounter data that appears to belong to another customer.

5. Safe harbor for good-faith research

If you follow the boundaries in this policy and act in good faith, we will not bring a legal claim against you for the research, and we will not report you to law enforcement for it. We consider your testing authorized for that purpose and will state our position if asked. This safe harbor does not cover damage to our systems or data, extortion, public disclosure before a fix is available, or access to another customer’s data, and it binds only us — it does not bind any third party and does not override any law that applies to you.

6. How we respond

• Acknowledgement: we aim to acknowledge a report within 48 hours.
• Initial assessment: we aim to provide a severity assessment and a resolution timeline within seven business days.
• Fix and disclosure: timing depends on severity, exploitability, and affected deployments. We coordinate a public disclosure date with you and credit you if you wish.
• If we cannot reproduce the issue, we will tell you what we tried so you can refine the report.

7. Bug bounty status

This is a coordinated-disclosure channel, not a public paid bug bounty. No reward is promised for a report. If a public bounty program opens, its scope, safe-harbor terms, and reward table will be published here before testing under it begins.